Are these principles mutually exclusive?
They are not exclusive but complementary.
Secure by default means it's secure out the box.
To cite from the recent publication by various international security agencies Shifting the Balance of Cybersecurity Risk:
Principles and Approaches for Security-byDesign and -Default, which I highly recommend to read in full:
“Secure-by-Default” means products are resilient against prevalent exploitation techniques out of the box without additional charge. These products protect against the most prevalent threats and vulnerabilities without end-users having to take additional steps to secure them. ... A secure configuration should be the default baseline. ... The complexity of security configuration should not be a customer problem. ...
So this is more about the configuration of the system. In the past systems often came with an insecure configuration by default, like trivial passwords, disabled encryption, open firewall settings etc. Users were expected to secure the system before putting it into production, but many did not to this or missed some important steps.
Secure by design means the software has been designed with a secure process throughout its lifecycle
It is more then this. It is how much the software can withstand attacks by design. It's less about quickly shipping patches if vulnerabilities get detected, but more about not needing security patches in the first place. To cite again from the publication:
“Secure-by-Design” means that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure. Software manufacturers should perform a risk assessment ...
Secure information technology (IT) development practices and multiple layers of defense ... holistic security approach ... cannot be “bolted on” later ...
